CloudNativePG vulnerabilities

CloudNativePG before versions 1.28.4 and 1.29.2 opened superuser connections without pinning search_path, allowing a role with DATABASE OWNER to execute attacker-controlled functions as the postgres superuser, including OS command execution and access to the pod ServiceAccount token.

CloudNativePG before versions 1.29.1 and 1.28.3 has a vulnerability in the metrics exporter that connects as the postgres superuser via a Unix socket and then demotes privileges with SET ROLE pg_monitor. An attacker can use RESET ROLE to regain superuser privileges and execute arbitrary system commands via COPY ... TO PROGRAM.

CloudNativePG prior to 1.28.4 and 1.29.2 embedded cleartext role passwords in ALTER ROLE and CREATE ROLE statements. With pg_stat_statements and track_utility enabled, an untrusted tenant with pg_monitor or pg_read_all_stats could recover platform-managed passwords and execute OS commands in the database pod. Fixed in 1.28.4, 1.29.2, and 1.30.0.